Identifying digital and physical threats.
Cheap drones and cheap AI have made soft targets vulnerable.
What changed
A drone that costs thousands of dollars can destroy an aircraft worth millions. In June 2025, Ukraine launched small drones from trucks parked near airbases deep inside Russia. US officials estimated they destroyed about 10 parked warplanes.
What changed
Finding a way into software got cheap too. In our own testing, it costs less than $10 of AI inference to find an exploitable flaw on public websites.
Source: our testing with Meerkat Watch. For comparison: Cloud Security Alliance, 2026, 21 FFmpeg zero-days for about $1,000 of compute.
Real event · August 2026 · Leipzig, Germany
Distance no longer protects soft targets. In August 2026, a quadcopter carrying explosives was found beside a Ukrainian cargo plane at Leipzig/Halle Airport in Germany. It reportedly carried two SIM cards and a 5G router, which would let it be flown over the mobile phone network from anywhere.
Sources: drone-warfare.com, 2026; Euronews, 2026; NPR, 2026
Real incidents
-
June 2025 · Russia
Drones launched from trucks destroyed about 10 parked warplanes.
-
July 2026 · Russia
Ukrainian drone strikes set Wildberries warehouses on fire. At least nine workers died in the first week.
-
August 2026 · Leipzig, Germany
A quadcopter carrying explosives was found beside a cargo plane. Germany blamed Russia.
-
Autumn 2025 · Europe
Drone sightings closed airports in Poland, Denmark, Norway, Germany and Belgium.
A fictional scenario
Consider this scenario of a hybrid attack on the power grid. By taking advantage of digital and physical vulnerabilities, an adversary can inflict damage orders of magnitude greater than the cost of the attack.
Weeks before
Weeks before, the attackers point AI tools at the public systems in the region: power utilities, town websites, fire, police, water utilities and emergency alerts.
Weeks before
They identify exploits and wait. State actors already work this way. In 2024, CISA reported that Volt Typhoon, a Chinese state actor, held quiet access inside US critical infrastructure networks, positioned for a crisis.
Source: CISA advisory AA24-038a
The evening
The attackers watch the forecast. A heat wave arrives, and air conditioning pushes demand on the grid close to its limit.
The evening
At the evening peak, preprogrammed drones launch toward the town's two substations. Each trails a long conductive line.
Real event · July 2020 · Pennsylvania
This has been tried. In July 2020, a drone carrying copper wire on nylon rope crashed beside a Pennsylvania substation. A joint FBI and DHS bulletin called it the first known case of a modified drone likely meant to target US energy infrastructure.
Sources: DroneDJ, 2021, reporting the FBI, DHS and NCTC bulletin; ABC News, 2021
The evening
The lines fall across live equipment, and both substations short-circuit.
The evening
The same thing is happening at four other places across the grid, in the same minute. Ten substations, chosen so the failures spread. North American grids are planned to survive the loss of one line, generator or transformer without a cascade. Losing a whole substation counts as an extreme event, which utilities must study but are not required to prevent.
Source: NERC TPL-001-5.1, Requirement R3 and Table 1
Reported analysis · 2014 · FERC
In 2014, the Wall Street Journal reported an internal FERC analysis that found knocking out nine key US substations could cause a coast-to-coast blackout lasting weeks.
Source: Utility Dive, 2014, reporting the Wall Street Journal
The evening
Each failure pushes load onto lines that are already running hot. Those lines trip, then the next ones. Across the grid, the lights go out.
Real event · August 2003 · Northeast blackout
In 2003 a blackout spread this way by accident. Line failures in northern Ohio cascaded across Ontario and eight US states in seven minutes. The area had 50 million people. US costs were estimated at $4 billion to $10 billion, and manufacturing shipments in Ontario fell by $2.3 billion that August. In New York City, about 90 more people died than expected.
Sources: U.S.-Canada Power System Outage Task Force, Final Report, 2004; Anderson and Bell, Epidemiology, 2012
The first hours
In the dark, the attackers use the digital vulnerabilities they discovered weeks ago. Evacuation orders go out from town, fire and police accounts. Water utilities say the tap water is unsafe. Posts ask residents to arm themselves and guard the fuel stations. Every message comes from an official source, and the sources agree with each other.
Real event · April 2017 · Dallas
In 2017, someone set off all 156 of Dallas's outdoor emergency sirens just before midnight. They sounded on and off for over an hour, and the city's 911 line was flooded with calls.
Source: Help Net Security, 2017, quoting City of Dallas statements
The first hours
Residents fill the roads. Fire and police chase calls that turn out to be false, or sit in traffic.
The first hours
Then timed incendiary devices ignite along the forest edge. With the roads jammed and crews tied up, the fires spread.
The months after
Repairs take months, and some take years. A large power transformer took 80 to 210 weeks to deliver in 2024. In 2025, US supply ran 30% short of demand.
Sources: Wood Mackenzie, 2024; Wood Mackenzie, 2025
The months after
The 2003 blackout was an accident on a single afternoon. This attack scenario is coordinated across a grid and timed for peak load. It could cost orders of magnitude more than 2003 did and recovery could take much longer.
Rewind
Now run the same attack again, with the threats identified.
Weeks before
Weeks before, Meerkat Watch tests the region's public systems the way an attacker would. It finds flaws like the ones the attackers would use and reports them to the utilities, the towns and the emergency services. They fix them. When the attackers scan, they find nothing to use.
The evening
The heat wave comes. At the evening peak, the drones launch.
The evening
Each substation has microphones listening. Substations are loud: transformers hum at 120 Hz and its harmonics. The drones' rotors add a different set of tones, and the microphones pick them out. Microphones listen for rotors, not radio links, so it does not matter how a drone is controlled. And a microphone emits nothing, so the attackers have no signal to find.
Source for the hum: Siemens Simcenter. The scene is an illustration, not a test result.
The evening
Five places report drones within the same minute. No single town sees a pattern. The grid operator sees all five, recognizes a coordinated attack, and de-energizes all ten substations before the drones arrive. The lines fall on equipment with no power in it, and nothing short-circuits.
The evening
Homes served by those ten substations go dark in a planned outage. The transformers survive, and the failure does not spread across the grid.
The first hours
The false alerts never go out, in any town. The flaws they depended on were fixed weeks ago. The roads stay clear.
The first hours
The incendiary devices still ignite. This time, fire crews reach them, because the roads are open and no false calls pull them away.
What we do
Shrike Ops identifies threats early enough for the people responsible to act. We work in two areas.